Advisory · de-identified
Advisory: GitHub Actions moving-tag pin drift
Moving GitHub Actions tags remain convenient, but they keep supply-chain authority outside your repository. Pin critical workflow actions to full commit SHAs and record the human-readable version beside the pin.
Published
What changed
This advisory consolidates a recurring review pattern: production workflows that pin marketplace actions to mutable tags such as @v3 or @v4.
Those tags are easy to read, but they leave the executed code outside the repository owner's change-control trail.
Recommended control
For critical workflow steps, pin the action to a full commit SHA and keep the version comment next to it for maintainability.
Review the pin on a dated cadence. The date matters: the security landscape changes, and the page should say when the recommendation was last checked.
Scope note
This advisory is de-identified and does not publish customer names, repository paths, workflow filenames, hostnames, tokens, environment names, or raw configuration excerpts.